As of today, 25 May 2018, penalties will begin rolling in for organisations that have not yet taken the necessary steps to ensure they are compliant with this restructured – and considerably more stringent – set of data protection regulations.

The GDPR is a regulation borne out of the European Parliament, Council of the European Union and European Commission’s joint intent to strengthen and unify data protection for EU citizens.

But just because the GDPR is an EU regulation, South African organisations are by no means off the hook. On the contrary, experts warn, local companies need to take the GDPR – positioned as one of the most significant changes in data privacy regulation in 20 years – very seriously.

The inescapable fact is, any South African company that handles personal data connected to the EU has to comply with the GDPR, and failure to do so will be met with the same major consequences EU organisations face for non-compliance.

Far-reaching forces

Over recent decades, not only has personal data has become an increasingly important corporate asset that needs to be handled with extreme care, it has also become geographically agnostic. This means that, today more than ever, with the exponential growth of data propagated across borders, organisations globally need to take a staunch and unified approach to guarding it.

South African organisations, big or small, are no different – and the GDPR is not the only government-led product of this hugely digital age, nor will it be the last, it is merely the latest one to be enforced.

Leilani Smit, compliance professional at Smit Compliance (Pty) Ltd, notes that the GDPR applies to any local organisation that holds or processes data on EU citizens, regardless of the location of its head office. “This includes companies that have employees in the EU, sell or market products or services in the EU, or partner with EU organisations.”

Leon van der Merwe, head of digital at customer communication firm PBSA and director of local digital signature and workflow solution SignFlow, adds that any South African entity controlling or processing data relating to EU citizens is affected by the GDPR. “Controlling refers to any organisation that states why and how data is processed, while a processor is any party doing the actual processing of the data, whether based in the EU, or not.”

World Wide Worx MD, Arthur Goldstuck, says the effects of the GDPR will be far-reaching due to the fact that the EU is SA’s biggest trade partner. “[On top of this], any company that does business with a company that has to comply with GDPR, will also have to comply, to ensure the client is in compliance.”

GDPR vs POPI

Fortunately for SA, details around the country’s own local version of data protection policy – the Protection of Personal Information (POPI) Act – have been highly publicised since 2013, and many companies will already be familiar – some even largely compliant – with what is expected of them in terms of data protection.

Summing up SA’s POPI Act, Michalson’s says: “Essentially, the purpose of [POPI] is to protect people from harm by protecting their personal information. To stop their money being stolen, to stop their identity being stolen, and generally to protect their privacy, which is a fundamental human right.”

Although – unlike the GDPR – it is still not known when POPI will come into effect, what is known is that companies will have a one-year transitional phase in which to comply once POPI’s implementation date is made public.

Smit says, should a local company already be compliant with international legislation such as GDPR, the implementation of policies to comply with POPI “should be a breeze and not require anything other than normal company practices and procedures”.

Van der Merwe says POPI and GDPR are similar in that both are intended to strengthen the protection of individuals’ personal information and privacy, and it is precisely this element – intention – that is key here, says Goldstuck.

The high price of non-compliance

Another area in which both sets of rules are similar, is in the hefty fines that come with non-compliance.

In a nutshell: breach rules laid out in the POPI Act, and face a R10 million fine and/or a jail sentence; fail to comply with the GDPR’s regulations, and be prepared to be slapped with a fine of up to €20 million (about R290 million) – or 4% of annual sales (whichever is greater).

Although possibly the biggest concern for companies, Smit notes that financial implications are not the only implications they should be worried about. “Not only can non-compliance result in fines and penalties set by the legislation itself, but [the] reputational damage of not processing information correctly, can often be more damaging that the initial penalty itself.”

It is this high price of non-compliance IT and legal experts hope will drive South African companies to do the right thing – not only for themselves, but ultimately for their customers – and fervently strive to meet GDPR compliance criteria.

Consumer-centric control

Van der Merwe says it is all about the consumer. “Both GDPR and POPI were ultimately created to protect the consumer’s privacy. We are all someone’s consumer, and even small businesses owners need to think carefully and logically about areas in their business where personal information is processed or stored, and what vulnerabilities may exist in their processes.

“For instance, we all receive CVs that contain heaps of personal and even sensitive information. Often, after a host of interviews, only the person’s CV that is employed, is securely transferred to a digital or physical vault in HR. What happens to the rest of the CVs that did not make it? It is the responsibility of any business to have policies and procedures to timeously and responsibly destroy such information. Simply identifying these vulnerabilities and implementing logical measures to manage them, is a good start for any size business.

“GDPR is a good thing that could be very bad news for companies, if they fail to provide evidentiary and auditable processes and adequate IT security to protect personal data.”

Goldstuck adds that it is not only important, but essential, that South African companies have a global view on data protection. “Something as simple as having a website hosted on an international platform can make a company liable to sanction under GDPR.”

Teaming up with tech

When it comes to local companies complying with the seemingly daunting and complicated GDPR in a relatively pain-free way, experts agree technology will be key. Software systems that offer automation, content management, enterprise resource planning and accounting, among others, will become a lifeline for many companies in their quest to comply.

Van der Merwe says existing paper-based processes and antiquated electronic systems that were created prior to factors such as the GDPR and POPI, pose major risks of contravening their laws and directives. “It is all about how businesses – and governments themselves – are going to align their physical and data processing practices with the new requirements and legislation. New regulations that enforce concepts such as the right to be forgotten pose major challenges if not considered in the process from the outset.”

Goldstuck says, while the data protection laws necessitate considerable changes in the ways businesses operate and interact with customers, good compliance systems will provide most of the safeguards they need.

“Businesses will have to get permission for almost every interaction with customers, they will have to become more discerning in what information they require from customers, and they will have to institute strict compliance systems to ensure they do not fall foul of these laws. As a result, compliance officers, CIOs and CTOs will have more direct roles to play in customer strategy.”

Don’t delay

Although not yet enforceable, the commencement date for POPI has been looming large on the horizon for some time now, with many expecting it by the end of 2018.

Despite this, say experts, many organisations are far from being ready. Goldstuck says: “Most large businesses have geared themselves up to comply with POPI, although many have not put this gearing up into effect. However, there is also an impression that many companies are simply not bothering until they are forced.”

Forrester’s 2018 predictions indicate that a whopping 80% of firms will not comply with GDPR regulations by May this year.

This has to change – and fast – says Smit. “Businesses can no longer just take a backseat and hope this will pass by or fly over. Active steps will have to be taken in an organisation, for instance staff training, risk assessments and creating an ethical culture within an organisation, specifically with regards to processing personal information.”

Instituted in 2003 to curb financial crimes, such as money laundering, tax evasion, and terrorist financing activities, FICA is a law that all financial institutions need to comply with. This includes any business that provides credit facilities in any form – whether assets like houses and cars, or retail items like mobile phone contracts and appliance/clothing accounts – or cash in the form of loans.

FICA basically makes it incumbent on all aforementioned financial services companies to reassess their entire client list, in order to ensure that all clients’ identities and finances can be verified. Think of it as a sweeping credit check of every person in an existing database – it is a means of identifying any individual who could potentially pose a threat to your company.

As with any law governing how businesses handle customer identification and verification processes, and how they manage records, FICA is multifaceted, and comes with severe penalties for businesses that are non-compliant.

Pain-free compliance

But, as daunting as this may sound, it does not need to be – nor does FICA compliance need to be another headache you have to deal with as a credit providing company.

South Africa’s leading data bureau, pbVerify, offers a range of services to make your path as a business striving for FICA compliance as straight as possible.

A division of pbDigital, under Customer Communications firm PBSA, pbVerify is essentially a credit risk management tool for any size business in South Africa that grants credit accounts and payment terms to other businesses and/or to South African consumers.

pbVerify’s online web-based tools help companies assess credit risk by evaluating the credit history of any business and its principles and/or any consumer a company wishes to grant credit terms to. This is done via multiple credit bureaus and other business critical data providers, through one easy-to-use website.

Included in pbVerify’s suite of services, are the following consumer credit check products, which offer your business a painless means of becoming FICA compliant:

Consumer traces for address validation: facilitated by three of South Africa’s main data credit bureaus – XDS, TransUnion and Compuscan – pbVerify’s consumer trace service gives you access to consumers’ latest contact information.

Bank account verification: pbVerify’s Bank Account Verification Service allows you to efficiently verify the bank details of a consumer, and determine the status of their account – whether the account is currently active, open or closed and whether it has been open for more than three months. The service is available for the 5 major banks in South Africa only.

CIPC Company & Director Verification: pbVerify’s CIPC Company Search Report – one of the most advanced CIPC search tools in South Africa – allows customers to easily retrieve and verify all registration information related to any registered South African business and its principles. Complementing this search too, is the CIPC Director Search Report.

ID Verification: The pbVerify Home Affairs ID Verification tool is used to determine the correct identity information on South African citizens. (This validates the consumer’s identification, but does not confirm whether or not they are credit active)

Alongside this, pbVerify’s ID verification API is used by various corporations, retailers, telecommunications companies, online service providers and system integrators to instantly verify identities for an range of different functions, including customer identification at point of sale, fraud prevention, online transaction verification, customer relations, human resource software and more.

There are two well-known and much-publicised Acts that make South African businesses shudder in their shoes – the Financial Intelligence Centre Act (FICA) of 2001 and the Protection of Personal Information (POPI) Act of 2013.

The two pieces of legislation have much in common. To begin with, they both have to do with how your business deals with customer identification and verification processes, and how it stores and maintains customer and transactional records. Secondly, there are severe penalties associated with non-compliance – severe enough, in many cases, to cause irreparable reputational and financial damage.

Third of all – and this is the good news – SignFlow can help you comply with both. Our digital signature workflow solution offers you an efficient and sure-fire means of making sure your business processes and IT systems are up to scratch when it comes to compliance with both these Acts – so you need no longer shy away from the dreaded “F-word” and “P-word”.

Portfolios

FICA and POPI compliance largely comes down to how you transmit, maintain and store customer data and, while the sheer volume and variety of data may make the process seem very complicated, SignFlow’s Portfolios feature offers you a surprisingly simple means of tackling it.

A SignFlow Portfolio is basically a portal where you can accumulate multiple documents that have been through a workflow and signed, in combination with documents that are just uploaded and stored.

Because there is no email (which is inherently insecure) involved and all documents are uploaded through a secure, encrypted channel, to an online portal where they can only be accessed by the individuals authorised to access them, Portfolios is an invaluable tool to have in your arsenal when you are striving for FICA and/or POPI compliance.

Let’s take an insurance company, for example:

The company requires identification and proof of residence documents (documents required by FICA that both also have a bearing on POPI) from a client.

That same client needs to sign a contract, which contains personal and financial information, and send it back to the company.

SignFlow Portfolios enables you and your client to upload and share documents (both signed and unsigned) via an encrypted portal.

There is no emailing, printing or scanning of documents involved at any stage.

All your client’s information is kept neatly in one designated, easy-to-access and searchable databank.

Given that the implementation date for the POPI Act is expected to be set this year – and in light of the FICA failures* we have seen in the past, you are under more pressure than ever before to make sure your business complies. Contact SignFlow today for more information on how we can ease the pressure and give you total peace of mind.

* In April 2014, the South African Reserve Bank fined the country’s four largest banks R125 million collectively for failing to comply with FICA. (www.sanews.gov.za)